| download: | NordVPNSetup.exe |
| Full analysis: | https://app.any.run/tasks/2dce59cd-5f1e-4295-ad71-dbeced24d9ee |
| Verdict: | Malicious activity |
| Analysis date: | September 07, 2019, 08:55:01 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 90E3EF7B3FCFED0E484FDB567F4B46CE |
| SHA1: | 5045BAA11DB4A0BEDB85D1513845ABCB10A8530F |
| SHA256: | F6E811C84B444705E26A53228E14ECFD1E62CEB1EDB8872664DEA23CD3491498 |
| SSDEEP: | 393216:9vsxVc2zk8lLvs5lPpryiZMBbFTURrvyZq:VETz1lLvyPEi8bVU9h |
MALICIOUS
Changes settings of System certificates
- NordVPNSetup.exe (PID: 1132)
Loads dropped or rewritten executable
- NordVPNSetup.exe (PID: 1132)
- rundll32.exe (PID: 704)
- nordvpn-service.exe (PID: 2464)
- NordVPN.exe (PID: 1188)
- openvpn-nordvpn.exe (PID: 2868)
- openvpn-nordvpn.exe (PID: 3124)
- NordVPN.exe (PID: 3108)
Loads the Task Scheduler DLL interface
- NordVPNSetup.exe (PID: 1132)
- NordVPNTapSetup.exe (PID: 3560)
Application was dropped or rewritten from another process
- NordVPNTapSetup.exe (PID: 3560)
- tapinstall.exe (PID: 3644)
- tapinstall.exe (PID: 3380)
- nordvpn-service.exe (PID: 2464)
- NordVPN.exe (PID: 3108)
- openvpn-nordvpn.exe (PID: 3124)
- openvpn-nordvpn.exe (PID: 2868)
- NordVPN.exe (PID: 1188)
Changes the autorun value in the registry
- NordVPN.exe (PID: 3108)
SUSPICIOUS
Creates files in the Windows directory
- NordVPNSetup.exe (PID: 1132)
- wusa.exe (PID: 2088)
- DrvInst.exe (PID: 2412)
- DrvInst.exe (PID: 3040)
- nordvpn-service.exe (PID: 2464)
Executable content was dropped or overwritten
- NordVPNSetup.exe (PID: 1132)
- wusa.exe (PID: 2088)
- NordVPNTapSetup.exe (PID: 3560)
- msiexec.exe (PID: 4072)
- rundll32.exe (PID: 704)
- DrvInst.exe (PID: 2412)
- DrvInst.exe (PID: 3040)
- tapinstall.exe (PID: 3380)
- NordVPNSetup.exe (PID: 1484)
Adds / modifies Windows certificates
- NordVPNSetup.exe (PID: 1132)
Starts CMD.EXE for commands execution
- NordVPNSetup.exe (PID: 1132)
Creates files in the user directory
- NordVPNSetup.exe (PID: 1132)
- NordVPN.exe (PID: 3108)
Reads Internet Cache Settings
- NordVPNSetup.exe (PID: 1132)
Starts Microsoft Installer
- NordVPNTapSetup.exe (PID: 3560)
Uses RUNDLL32.EXE to load library
- MsiExec.exe (PID: 3776)
- DrvInst.exe (PID: 2412)
Reads Environment values
- MsiExec.exe (PID: 3848)
- MsiExec.exe (PID: 2344)
- NordVPN.exe (PID: 3108)
Executed via COM
- DrvInst.exe (PID: 2412)
- DrvInst.exe (PID: 948)
- DrvInst.exe (PID: 3040)
Removes files from Windows directory
- DrvInst.exe (PID: 2412)
- DrvInst.exe (PID: 3040)
- NordVPNSetup.exe (PID: 1132)
- nordvpn-service.exe (PID: 2464)
Creates files in the driver directory
- DrvInst.exe (PID: 2412)
- DrvInst.exe (PID: 3040)
Executed as Windows Service
- vssvc.exe (PID: 2728)
- nordvpn-service.exe (PID: 2464)
Application launched itself
- NordVPNSetup.exe (PID: 1132)
Modifies the open verb of a shell class
- msiexec.exe (PID: 4072)
- NordVPN.exe (PID: 3108)
Changes the autorun value in the registry
- msiexec.exe (PID: 4072)
Changes IE settings (feature browser emulation)
- msiexec.exe (PID: 4072)
Creates files in the program directory
- nordvpn-service.exe (PID: 2464)
- NordVPNSetup.exe (PID: 1484)
INFO
Loads dropped or rewritten executable
- MsiExec.exe (PID: 3848)
- MsiExec.exe (PID: 3248)
- MsiExec.exe (PID: 3776)
- MsiExec.exe (PID: 2812)
- MsiExec.exe (PID: 1248)
- MsiExec.exe (PID: 2344)
Creates a software uninstall entry
- msiexec.exe (PID: 4072)
Application launched itself
- msiexec.exe (PID: 4072)
Searches for installed software
- DrvInst.exe (PID: 2412)
Creates files in the program directory
- msiexec.exe (PID: 4072)
Low-level read access rights to disk partition
- vssvc.exe (PID: 2728)
Dropped object may contain Bitcoin addresses
- NordVPNSetup.exe (PID: 1132)
- msiexec.exe (PID: 4072)
- nordvpn-service.exe (PID: 2464)
Manual execution by user
- NordVPN.exe (PID: 1188)
Reads settings of System Certificates
- NordVPN.exe (PID: 3108)
- nordvpn-service.exe (PID: 2464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (3.6) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (1.6) |
| .exe | | | DOS Executable Generic (1.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:07:02 11:56:19+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 14.21 |
| CodeSize: | 1518080 |
| InitializedDataSize: | 680448 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x121c46 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.23.11.0 |
| ProductVersionNumber: | 6.23.11.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | Debug |
| FileOS: | Win32 |
| ObjectFileType: | Dynamic link library |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | NordVPN |
| FileDescription: | NordVPN Installer |
| FileVersion: | 6.23.11 |
| InternalName: | NordVPNSetup |
| LegalCopyright: | Copyright (C) 2019 NordVPN |
| OriginalFileName: | NordVPNSetup.exe |
| ProductName: | NordVPN |
| ProductVersion: | 6.23.11 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 02-Jul-2019 09:56:19 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | NordVPN |
| FileDescription: | NordVPN Installer |
| FileVersion: | 6.23.11 |
| InternalName: | NordVPNSetup |
| LegalCopyright: | Copyright (C) 2019 NordVPN |
| OriginalFileName: | NordVPNSetup.exe |
| ProductName: | NordVPN |
| ProductVersion: | 6.23.11 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000118 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 02-Jul-2019 09:56:19 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x001729AF | 0x00172A00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.45178 |
.rdata | 0x00174000 | 0x0005DF74 | 0x0005E000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.60132 |
.data | 0x001D2000 | 0x00007140 | 0x00005400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.10585 |
.rsrc | 0x001DA000 | 0x000296C0 | 0x00029800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.64596 |
.reloc | 0x00204000 | 0x00019464 | 0x00019600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.55241 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.18998 | 1909 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 4.88312 | 67624 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.07899 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 5.12416 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.83362 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 3.37783 | 1116 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.35254 | 1888 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.31743 | 760 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 3.23118 | 1432 | Latin 1 / Western European | English - United States | RT_STRING |
13 | 3.35766 | 820 | Latin 1 / Western European | English - United States | RT_STRING |
Imports
KERNEL32.dll |
msi.dll (delay-loaded) |
Total processes
81
Monitored processes
32
Malicious processes
11
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 704 | rundll32.exe "C:\Windows\Installer\MSI3197.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1520046 11 TapInstaller!TapInstaller.CustomActions.InstallTapAdapter | C:\Windows\system32\rundll32.exe | MsiExec.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 948 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000005E0" "000005DC" | C:\Windows\system32\DrvInst.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1132 | "C:\Users\admin\Desktop\NordVPNSetup.exe" | C:\Users\admin\Desktop\NordVPNSetup.exe | explorer.exe | ||||||||||||
User: admin Company: NordVPN Integrity Level: HIGH Description: NordVPN Installer Exit code: 0 Version: 6.23.11 Modules
| |||||||||||||||
| 1188 | "C:\Program Files\NordVPN\NordVPN.exe" | C:\Program Files\NordVPN\NordVPN.exe | — | explorer.exe | |||||||||||
User: admin Company: NordVPN Integrity Level: MEDIUM Description: NordVPN Exit code: 2 Version: 6.23.11.0 Modules
| |||||||||||||||
| 1248 | C:\Windows\system32\MsiExec.exe -Embedding D624C048B75BFC6008446ED9CE5E473A M Global\MSI0000 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1484 | "C:\Users\admin\Desktop\NordVPNSetup.exe" /i "C:\Windows\Temp\NordVPN\NordVPN 6.23.11\install\92C760E\NordVPN Setup.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\NordVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="1132" AI_MORE_CMD_LINE=1 | C:\Users\admin\Desktop\NordVPNSetup.exe | NordVPNSetup.exe | ||||||||||||
User: admin Company: NordVPN Integrity Level: HIGH Description: NordVPN Installer Exit code: 0 Version: 6.23.11 Modules
| |||||||||||||||
| 2088 | "C:\Windows\system32\wusa.exe" "C:\Users\admin\AppData\Roaming\NordVPN\NordVPN\prerequisites\Windows6.1-KB3033929-x86.msu" | C:\Windows\system32\wusa.exe | NordVPNSetup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Update Standalone Installer Exit code: 1223 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2272 | Find "KB3033929" | C:\Windows\system32\find.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (grep) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2344 | C:\Windows\system32\MsiExec.exe -Embedding D0E128DD86A77D8C0532A612DF85D5D9 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2412 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{59ceafb2-6ac8-05d6-74e6-e606b6c18c4b}\oemvista.inf" "0" "6166dbbc3" "000004B8" "WinSta0\Default" "000005B8" "208" "c:\program files\nordvpn network tap\default\i386" | C:\Windows\system32\DrvInst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
4 649
Read events
2 716
Write events
1 851
Delete events
82
Modification events
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD |
| Operation: | write | Name: | Blob |
Value: 040000000100000010000000C5DFB849CA051355EE2DBA1AC33EB0280F00000001000000200000005229BA15B31B0C6F4CCA89C2985177974327D1B689A3B935A0BD975532AF22AB090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B000000010000003000000047006C006F00620061006C005300690067006E00200052006F006F00740020004300410020002D0020005200330000005300000001000000230000003021301F06092B06010401A032010130123010060A2B0601040182373C0101030200C0620000000100000020000000CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B1400000001000000140000008FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC1D000000010000001000000001728E1ECF7A9D86FB3CEC8948ABA953030000000100000014000000D69B561148F01C77C54578C10926DF5B856976AD190000000100000010000000D0FD3C9C380D7B65E26B9A3FEDD39B8F2000000001000000630300003082035F30820247A003020102020B04000000000121585308A2300D06092A864886F70D01010B0500304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E301E170D3039303331383130303030305A170D3239303331383130303030305A304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E30820122300D06092A864886F70D01010105000382010F003082010A0282010100CC2576907906782216F5C083B684CA289EFD057611C5AD8872FC460243C7B28A9D045F24CB2E4BE1608246E152AB0C8147706CDD64D1EBF52CA30F823D0C2BAE97D7B614861079BB3B1380778C08E149D26A622F1F5EFA9668DF892795389F06D73EC9CB26590D73DEB0C8E9260E8315C6EF5B8BD20460CA49A628F6693BF6CBC82891E59D8A615737AC7414DC74E03AEE722F2E9CFBD0BBBFF53D00E10633E8822BAE53A63A16738CDD410E203AC0B4A7A1E9B24F902E3260E957CBB904926868E538266075B29F77FF9114EFAE2049FCAD401548D1023161195EB897EFAD77B7649A7ABF5FC113EF9B62FB0D6CE0546916A903DA6EE983937176C6698582170203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604148FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC300D06092A864886F70D01010B050003820101004B40DBC050AAFEC80CEFF796544549BB96000941ACB3138686280733CA6BE674B9BA002DAEA40AD3F5F1F10F8ABF73674A83C7447B78E0AF6E6C6F03298E333945C38EE4B9576CAAFC1296EC53C62DE4246CB99463FBDC536867563E83B8CF3521C3C968FECEDAC253AACC908AE9F05D468C95DD7A58281A2F1DDECD0037418FED446DD75328977EF367041E15D78A96B4D3DE4C27A44C1B737376F41799C21F7A0EE32D08AD0A1C2CFF3CAB550E0F917E36EBC35749BEE12E2D7C608BC3415113239DCEF7326B9401A899E72C331F3A3B25D28640CE3B2C8678C9612F14BAEEDB556FDF84EE05094DBD28D872CED36250651EEB92978331D9B3B5CA47583F5F | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1132) NordVPNSetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\NordVPNSetup_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
Executable files
151
Suspicious files
49
Text files
542
Unknown types
48
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1132 | NordVPNSetup.exe | C:\Windows\Temp\NordVPN\NordVPN 6.23.11\install\holder0.aiph | — | |
MD5:— | SHA256:— | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\MSIB2AC.tmp | — | |
MD5:— | SHA256:— | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\MSIB349.tmp | — | |
MD5:— | SHA256:— | |||
| 1132 | NordVPNSetup.exe | C:\Windows\Temp\NordVPN\NordVPN 6.23.11\install\92C760E\NordVPN Setup.msi | executable | |
MD5:— | SHA256:— | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\MSIB105.LOG | text | |
MD5:— | SHA256:— | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_1132\sys_min_down.png | image | |
MD5:38375B1DD82D4BA1A3A8C12EEF4ADED6 | SHA256:EAED9874836DAE7EA6C5D6BF914EBD34263880D745AD61D24D215767A4E355CF | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_1132\Repair.png | image | |
MD5:F025E256516A17685F925284E5A135BD | SHA256:936B578F345FBCE3B503E4E1AD1E81D35CE71CFA6CD9DD4D3BF0C1BD6C151567 | |||
| 1132 | NordVPNSetup.exe | C:\Windows\Temp\NordVPN\NordVPN 6.23.11\install\decoder.dll | executable | |
MD5:2459C45F8158975CA893E7F157B6D23D | SHA256:037732D00819C4790AE3D61C9A0851ED9E9FC578F97976F9CB2629074768469F | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\MSIB35A.tmp | executable | |
MD5:5576BF4D22DC695564E49A68CBC98BC2 | SHA256:20F76FFD846155A41633D75CB2E784E54F6EC77CA9CA9D52D9510C3E2E918801 | |||
| 1132 | NordVPNSetup.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_1132\insticon | image | |
MD5:BFBE8F838AFC6156CF2362E81F713A52 | SHA256:251099323513EA86DD5BC2C0BF8503AA364DB7B40B214C288FCC1A76A97B6D88 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
9
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1132 | NordVPNSetup.exe | 2.18.233.19:443 | download.microsoft.com | Akamai International B.V. | — | whitelisted |
3108 | NordVPN.exe | 104.17.187.107:443 | zwyr157wwiu6eior.com | Cloudflare Inc | US | shared |
3108 | NordVPN.exe | 104.16.160.101:443 | applytics.zwyr157wwiu6eior.com | Cloudflare Inc | US | shared |
3108 | NordVPN.exe | 104.17.167.30:443 | downloads.nordcdn.com | Cloudflare Inc | US | shared |
3108 | NordVPN.exe | 104.17.188.107:443 | zwyr157wwiu6eior.com | Cloudflare Inc | US | shared |
3108 | NordVPN.exe | 18.208.6.180:8884 | nc-unit2-mqtt.nordvpn.com | — | US | unknown |
2464 | nordvpn-service.exe | 104.17.168.30:443 | downloads.nordcdn.com | Cloudflare Inc | US | shared |
2868 | openvpn-nordvpn.exe | 185.176.221.170:1194 | — | — | LV | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
download.microsoft.com |
| whitelisted |
applytics.zwyr157wwiu6eior.com |
| unknown |
zwyr157wwiu6eior.com |
| unknown |
downloads.nordcdn.com |
| unknown |
nc-unit2-mqtt.nordvpn.com |
| unknown |
ocsp2.globalsign.com |
| whitelisted |
crl.globalsign.com |
| whitelisted |